Twenty to one

A regulator decides to meter the machines

On 30 October 2026 the Capital Market Authority of Saudi Arabia issued a circular to financial market institutions that does two things at once. First, it imposes a hard quantitative limit on algorithmic order flow: a weighted order-to-trade ratio that, for each registered trader and each security, must not exceed twenty. Second, it wraps that limit in a full governance regime for algorithmic trading, covering how systems are tested, how they are monitored, how they can be stopped, and how long their records must be kept. The measure takes effect on 1 November 2026.¹

The timing is not accidental. Algorithmic trading now accounts for roughly a quarter of all trading value on the Saudi market, a share that has grown quickly and that the CMA's own leadership has flagged publicly.² When automated trading moves from the margins to a quarter of the market, a regulator starts to worry about the thing that automated trading produces in abundance and that human trading does not: messages. Orders placed, amended and cancelled at machine speed, most of which never become a trade. That is the behaviour this circular is built to meter.

What makes it worth reading is the combination. Plenty of regimes write governance rules for algorithms, requiring testing, monitoring and a kill switch. Fewer put a hard, computed number on how much an algorithm is allowed to flood a single instrument. Saudi Arabia is now doing both, and the number it has chosen, together with the formula behind it, says something precise about what the regulator actually fears.

What the number actually measures

An order-to-trade ratio is one of the oldest and bluntest tools in market-structure regulation, and it answers a simple question: how much noise are you making for every real thing you do? In an automated market, the noise is messages. Every order a system sends, every time it amends that order, and every time it cancels it, is a message the exchange has to process. A trade, an actual execution, is the signal. A high order-to-trade ratio means a participant is flooding the book with activity that mostly evaporates.

The CMA's formula is worth reading closely, because its weightings are the whole point:

Read the weightings as a statement of values. Entering an order costs you one. Cancelling it costs you one. Amending it costs you two. The only move that buys back headroom is executing a real trade. A firm whose algorithms post, re-post and pull quotes thousands of times for every fill will blow through the ceiling; a firm that trades when it quotes will sit comfortably beneath it. The rule does not ban fast or automated trading. It prices the specific thing that automated trading can do to a market, which is to bury genuine liquidity under a blizzard of orders that were never meant to trade.

The design has sensible edges. The limit is applied per security rather than across a whole book, so a firm cannot average a spammed instrument against a quiet one. It is tiered to the liquidity of the instrument, recognising that a thickly traded blue chip and a thin small cap do not behave the same way. And index-tracking and market-making style flows, where high message rates are a feature rather than an abuse, are treated as a defined exception rather than swept in.¹ The threshold emerged from a public consultation earlier in 2026 before being finalised in the circular.³

Pricing the noise, not just policing the intent

Most modern rules about algorithmic trading are about behaviour and intent. Do not spoof. Do not layer. Do not send messages that disrupt the exchange's systems. These rules are necessary, but they share a weakness: they require a regulator to prove something about why a participant did what it did, and to catch it after the fact. An order-to-trade ratio is a different kind of instrument entirely. It does not ask why. It sets a measurable budget, computes your consumption of it automatically, and tells you when you are over. It is prevention by arithmetic.

That bluntness is a strength as much as a limitation. A participant does not need to intend harm to flood a market; a miscalibrated or malfunctioning algorithm will do it with perfect innocence, as the enforcement record on both sides of the Atlantic shows. A hard ceiling catches the innocent flood and the deliberate one alike, because it does not care about the motive, only the message count. It turns a question of conduct into a question of plumbing.

A behaviour rule asks a regulator to read a trader's mind after the damage is done. A ratio cap just reads the message log, and it reads it the same way whether the flood was malice or a bug.

The cost of bluntness is calibration risk. Set the ceiling too low and you penalise legitimate market-making, which genuinely needs to quote and re-quote; set it too high and it never binds. The CMA has tried to manage this with tiering and the market-making exception, which is the right instinct. But the deeper point stands: a ratio cap is a complement to the conduct rules, not a replacement. It thins the blizzard so that the surveillance looking for genuine manipulation has a clearer sky to watch.

The rest of the circular is the Knight checklist

The ratio cap is the headline, but it sits on top of a governance package that will look familiar to anyone who has read the post-mortems of the last decade's automated-trading disasters. Citing the Financial Market Institutions Regulations, the CMA requires firms to build and maintain a set of controls around every algorithm they run.¹

None of this is novel in isolation. It is, almost line for line, the set of controls that the EU's MiFID II wrote into law after a decade of flash events, and that the failures of firms like Knight Capital taught the hard way. What is notable is seeing it arrive as a complete package, in a market where algorithmic trading has only recently become dominant, with the quantitative cap and the governance requirements landing together rather than a decade apart.

Why "be able to switch it off" is the hardest line in the circular

The requirement to be able to prevent an algorithm from operating is one sentence in the circular and an enormous engineering and governance problem in practice. It is also the requirement most directly vindicated by recent enforcement. The reason regulators keep writing "you must be able to stop it" into their rules is that firms keep failing to stop their own systems in time.

The clearest recent illustration sits just across the Gulf's trading week in the United States. A proprietary firm's automated system flooded an exchange's matching engine with cancel messages, inducing a delay it then traded into, and kept doing so for nearly a year after the exchange told it to stop, because nothing in the firm was positioned and willing to halt a profitable machine.⁴ The lesson, which the CMA's requirement encodes, is that a kill switch is not a button you install once. It is a standing capability that has to be designed with the right granularity, owned by someone with the authority to use it, and backed by procedures for when to pull it and, just as importantly, when it is safe to turn the system back on.

Pair that with the testing requirement and the circular is quietly demanding something firms find genuinely hard: a faithful way to test an algorithm before it touches the live market, and again while it runs. Testing an automated strategy against a realistic reproduction of live conditions is one of the most under-resourced problems in the industry, and "test continuously" is a high bar when the thing being tested changes its own behaviour in response to the market. The CMA has written the expectation. Meeting it is a build.

A decade of records, counted from the day you switch it off

The retention requirement is easy to skim past and worth pausing on, because of how it is counted. Firms must keep the data, the policies, the strategies, the controls and the development and testing documentation for ten years not from creation, but from the day the algorithm is discontinued or changed. An algorithm that runs for five years and is then retired must have its full paper trail preserved until fifteen years after it was first switched on.

This is a reconstructability requirement in disguise. A regulator investigating a disorderly market two or three years from now needs to be able to ask what an algorithm was doing, why it was doing it, how it had been tested, and who had signed off on it, long after the strategy itself has been switched off and the team that built it has moved on. Ten years is a long institutional memory to demand, and it forces a discipline that firms often neglect: versioning and documenting not just the code, but the intent, the tests and the approvals behind every automated strategy, so that the story can be told years after the fact.

It is also, quietly, an answer to the most uncomfortable property of modern automated systems, which is that the people who understand them leave. A ten-year, post-retirement record is the regulator insisting that the understanding outlive the engineers.

Three ways to regulate an algorithm

Place the CMA's circular beside the rest of the world's approaches and a clear map emerges. Regulators have three broad tools for algorithmic trading, and most regimes lean on one or two. Saudi Arabia has now reached for all three at once.

The conduct-rule end of the spectrum is where the enforcement headlines live: the exchange that fines a firm for flooding its matching engine, or for prearranged and non-competitive trades.⁴ The governance end is where the forward-looking guidance is being written, as supervisors from the United Kingdom to Singapore set out expectations for how firms should build, test and oversee their automated and increasingly AI-driven systems.⁵⁶ What is distinctive about the Saudi circular is that it does not pick a lane. It pairs a hard order-to-trade ceiling with a full governance package, in a single instrument, and applies it to a market where automation has become material fast enough that the regulator has decided it cannot afford to phase the tools in one at a time.

What a desk trading into Saudi Arabia needs to prove

For any firm running algorithms into the Saudi market, the circular turns several things that were good practice into testable obligations. The questions a supervisor can now ask are concrete, and a firm should be able to answer each one with evidence rather than intention.

• Can you measure your own order-to-trade ratio, live, per security and per trader? The cap is computed the way the regulator computes it, with amendments weighted double. A firm that cannot see its own ratio in real time cannot manage to it.
• Do you have a pre-trade brake, not just a report? A ratio you discover at the end of the session is a breach you have already committed. The useful control throttles or halts order flow as the ratio approaches the ceiling.
• Can you actually switch an algorithm off? Not in theory. A tested kill switch, with a named owner, the right granularity to stop one strategy without stopping the desk, and a procedure for resuming safely afterwards.
• Can you show the testing? Evidence that each algorithm was tested before deployment and is tested continuously, against realistic conditions, with the results documented.
• Can you reconstruct it in ten years? Versioned records of the code, the strategy, the tests and the approvals, retained for a decade after the algorithm is retired, and producible to the regulator on request.

The world is converging on how to hold an algorithm accountable

Strip away the specific number and the Saudi circular is a data point in a global convergence. Across very different markets and legal systems, regulators are arriving at the same short list of demands for anyone who lets a machine trade: bound how much it can do, prove you tested it, watch it while it runs, be able to stop it, and keep the records long enough to answer for it later. The CMA has simply assembled the whole list in one document and attached a hard number to the first item.

That convergence matters most for what is coming next. The algorithms this circular governs are, for now, mostly deterministic systems following rules their authors wrote. The next generation will be adaptive and increasingly AI-driven, changing their own behaviour in response to the market in ways no one explicitly programmed. Every requirement in this circular gets harder, and more important, when the thing being governed is a learning system. Testing a model that changes is harder than testing fixed code. Monitoring an adaptive strategy is harder than monitoring a static one. And a hard order-to-trade ceiling becomes something valuable in a way its drafters may not have fully intended: a blunt, external, arithmetic limit that holds even when a sophisticated system finds a clever way around every behavioural rule you wrote.

That is the quiet wisdom of a ratio cap in an age of intelligent machines. You cannot always anticipate how an adaptive system will misbehave, and you cannot always read its intent. But you can count its messages, and you can tell it that twenty is the limit. When the systems become too clever to police by their conduct alone, the blunt instruments are the ones that still work.