Settings too wide by default

A setting nobody owned

On 16 September 2026, Nasdaq ISE accepted a Letter of Acceptance, Waiver and Consent from CTC, LLC, a Chicago options market maker and ISE member since 2001, which agreed to a censure and a $100,000 fine without admitting or denying the findings. Across an eighteen-month review period, from October 2024 to April 2026, CTC had breached two of the exchange's quoting rules and the supervision rules behind them. The headline number is arresting for how mundane its cause was. As a Competitive Market Maker, the firm submitted quotes wider than the maximum allowable spread in millions of instances, and almost all of it traced back to a single configuration value.

When CTC moved to a new quoting platform, the platform supported only one instance-level setting for maximum quote width, rather than a setting per product. The default it shipped with was wider than the maximum spread ISE allowed, and because there was only one setting, that too-wide default was inherited by every product added to the platform afterward. The firm tuned the width for some symbols over time, but the default itself stayed wider than the rule for much of the review period. A quote spread that is too wide is not a dramatic event; it is a number in a config file that nobody changed, repeated across products and across months until it had happened millions of times.

This is not a story about a market maker trying to game anything. It is a story about defaults, surveillance that watches without acting, and a registration the firm thought it had exited. Each of the three is a small, familiar operational failure, and together they are a clean illustration of how an electronic trading business accumulates millions of violations quietly, from controls that looked present on paper and did nothing in practice.

One setting, inherited everywhere

The Quote Spread Rule is simple in intent: a market maker that is quoting a series must keep its bid and ask within a maximum width, so that the quotes it posts are useful prices rather than placeholders too far apart to trade against. Compliance with it is almost entirely a matter of configuration. The width is set in the quoting system, and if the setting is correct, the rule is met continuously and automatically; if it is wrong, it is broken continuously and automatically. There is very little human judgment between the setting and the outcome, which is exactly why the setting has to be right.

CTC's new platform made the setting brittle in a specific way. It allowed only one maximum-width value for the whole instance, rather than a value tuned to each product, even though the allowable spread differs by series. A single global setting cannot be correct for a diverse book, and the one the platform defaulted to was wider than ISE permitted. Worse, the single-setting design meant the error propagated by itself: every new product added to the platform inherited the same too-wide default, so the problem grew as the business grew, without anyone making a new mistake. The firm corrected the width for certain symbols, but never fixed the default underneath, so the gap persisted for most of the eighteen months.

The lesson sits above options market making. A default is a decision, usually made by a vendor, that a firm adopts by not overriding it, and a default that governs a regulatory obligation is a control with no owner unless someone is assigned to set it, justify it and test it. A single global parameter standing in for what should be many product-specific ones is a design that guarantees the parameter is wrong somewhere, and inheritance turns one wrong value into a growing population of breaches.

An alert that created no ticket

If the width was wrong, the obvious question is why it ran for eighteen months without being fixed, and the answer is the most portable part of the case. CTC did have surveillance for the Quote Spread Rule. It ran a dashboard that showed traders real-time alerts when quotes went too wide. What the dashboard did not do was generate a persistent alert or a ticket that forced escalation and review. The signal flashed and passed. Nothing created a durable record that a violation had occurred, routed it to someone accountable, or required that it be investigated and closed. The information existed; the control did not.

This is the distinction that matters, and it is easy to miss. A real-time dashboard helps a trader adjust in the moment, but it is a convenience, not a compliance control, because it leaves no trail and compels no action. A reasonably designed surveillance system turns a detection into an obligation: a ticket that must be worked, an escalation that reaches a supervisor, a review that ends in a documented disposition. Without that machinery, a firm can be watching a problem continuously and still never fix it, which is precisely what happened here. ISE also found that CTC had no reasonable process to take up the quote-spread relief the exchange offered, implement it, and verify it, which is the same failure in a different place: information available, no system to act on it.

The registration it thought it left

The second violation is a different kind of mistake and just as instructive. The Continuous Quoting Rule requires a market maker to post two-sided quotes for a set share of the time its assigned series are open, and CTC fell short in 121 instances. The cause was not a bad width but a bad assumption. When the firm sought to withdraw as a Competitive Market Maker in certain series, it did not withdraw all of the applicable badges from registration. It believed it had withdrawn, and so it stopped surveilling for continuous-quoting compliance. But because the badges were still registered, it remained a market maker with a continuing obligation to quote, in series it thought it had left and was no longer watching.

Underneath sat a data gap that made the whole thing hard to see: CTC's continuous-quoting surveillance did not track performance at the badge level. That single omission did two things. It stopped the firm from using Nasdaq's aggregation methodology to calculate quote-spread compliance, and it meant that when the firm tried to withdraw, it could not reliably identify which of its badges were actually registered as a market maker in each series. A withdrawal you cannot verify is an intention, not a fact, and standing down your surveillance on the strength of it is how an obligation you believe is gone keeps generating violations.

Procedures that restated the rule

Behind both failures ISE found the same supervisory hole. CTC had written supervisory procedures that purported to cover its market-making obligations, but they merely restated the requirements of the rules. They did not address the supervisory steps the exchange expects, and they did not address the firm's own surveillance system at all. A procedure that recites the rule tells an employee what the outcome must be, which they already knew, and says nothing about how the firm will achieve and check it, which is the only thing a procedure is for.

This is one of the most common findings in all of market supervision, and this case shows exactly why it matters. A procedure that restates the Quote Spread Rule would not have told anyone that a single global width setting was dangerous, that the default was too wide, or that the dashboard needed to generate tickets. A procedure that restated the Continuous Quoting Rule would not have told anyone to verify that all badges had actually been withdrawn before standing down surveillance. The operational decisions that caused the violations live in the space between the rule and the practice, and that is the space a real supervisory procedure is supposed to fill. CTC's left it empty, which is why nothing in its own framework was positioned to catch the configuration and withdrawal errors as they ran.

Where automated obligations fail

Pulled together, the case is a short course in how compliance works, or does not, when the obligation is automated. In an electronic market-making business, whole categories of rule are satisfied or broken by configuration rather than conduct, and that changes where the risk lives. There is no misjudgment to catch in the moment, because a human is rarely in the loop; there is a setting that is right or wrong, and a setting that is wrong is wrong continuously, at machine scale, from the instant it is deployed. The control that matters is not a trader's discretion but the process that owns, justifies and tests the parameters, and the surveillance that makes a deviation impossible to ignore.

Both of CTC's root causes are failures of that process rather than of intent. A default inherited across products is a configuration-governance failure: no owner, no per-product justification, no test that would have flagged the default as out of bounds. A withdrawal that was assumed rather than verified is a state-management failure: the firm acted on a belief about its own registration that its data could not confirm. And the thing that let both run, a dashboard that alerted without escalating, is the failure that ties the series together, because it is the difference between seeing a problem and being made to solve it. Detection without a forced response is not control; it is awareness, and awareness does not file a ticket.

The reassuring part, for any firm reading this, is that none of it required sophistication to prevent. Product-specific width settings with a named owner, surveillance that raises a persistent, escalatable alert, a check that a withdrawal completed before monitoring stops, and supervisory procedures that describe the how rather than reprint the what, would each have broken the chain. The failures were ordinary, which is the point: ordinary is where millions of violations come from.

Own the settings, act on the alerts

The first lesson is to treat every default that governs a regulatory obligation as an owned, justified and tested setting, never as something the platform decided. Where a rule varies by product, the configuration must vary by product too; a single global parameter standing in for many is a guarantee that the parameter is wrong somewhere, and on a platform that inherits one setting across products, one wrong value becomes a growing population of breaches. Any migration to a new trading platform should begin with a check that its configuration model can actually express the firm's obligations at the granularity the rules require.

The second is to insist that surveillance produce action, not just awareness. A real-time dashboard is useful, but a compliance control has to generate a persistent alert or ticket that is routed, escalated and closed with a documented disposition. The test is simple: if a violation occurred today, would a record of it exist tomorrow, and would someone be obliged to work it. If the answer is no, the firm is watching a problem it has no mechanism to fix. The same discipline applies to exchange relief and parameter changes, which need a process to ingest, implement and verify, not just to receive.

The third is to manage registration as a verified state, and to make procedures operational. A market maker should confirm that a withdrawal has actually completed, badge by badge, before it stands down the surveillance tied to that obligation, and its systems should track performance at the granularity, here the badge level, that lets it know what it is still registered to do. And the written procedures that sit over all of this should describe how the firm sets its parameters, works its alerts and verifies its registrations, rather than restating the rules those activities are meant to satisfy. A procedure that only names the outcome has delegated the method to chance.

The options market makers before it

Exchange enforcement against options market makers for quoting and supervision failures is not occasional; it is a standing program, and CTC joins a line of firms disciplined for the same family of control gaps. These three, across two major venues and four years, show how settled the pattern is.

The constant across all three, and CTC, is that the exchange is not chasing bad prices so much as weak control. None of these firms was found to have manipulated anything. Each was found to have run a market-making operation whose quoting obligations outran its configuration and its supervision, which is the precise risk that automation creates and only governance contains.

Configuration is the new conduct

The CTC matter captures a shift in what exchange supervision is actually about. For electronic market makers, the compliance surface has moved from the trader to the system, and the violations that matter now are born in configuration files, registration states and surveillance logic rather than in anyone's decision to misbehave. Regulators have followed the risk there. The willingness to detail a single too-wide default, a dashboard that produced no ticket, and a withdrawal that was never completed is a signal that the internals of a trading platform, and the governance around them, are squarely what examiners will look at.

A second theme is the steady insistence that detection is not control. Across this case and its parallels, firms are rarely found to lack information; they are found to lack the machinery that turns information into a forced, documented response. An alert that no one must act on, relief that no one implements, a performance feed that does not reach the badge level: each is a place where a firm could see the problem and still not be made to solve it. The direction of travel is clear, and it rewards surveillance that compels action over surveillance that merely displays it.

The durable lesson reaches any business where obligations are met by configuration rather than conduct, which is a growing share of modern finance. Own your defaults, because a default is a decision you have delegated. Build surveillance that files a ticket, because awareness without accountability changes nothing. Verify your states rather than assuming them, because an obligation you believe is gone can keep running. And write procedures that describe the method, not the rule, because the failures that cost millions live in the method. CTC's violations were small, ordinary and automated, and that is exactly why they reached into the millions before anyone had to answer for them.